System or event messages are usually automatically generated when specific events occur during operation of a computer system or computer network. Usually the most useful system or event messages are those generated when an error occurs in a system or network. In a network, the system or event messages are typically “syslog” messages.
A syslog message may often provide important information to diagnose error conditions in a network. However, in many cases, situations are encountered in which a problem is indicated by a syslog message, but the information that is provided with the syslog message does not provide sufficient information about what caused it. Network users often require assistance from Technical Assistance Centers (TAC) or help desks with diagnostics that involve such messages. In such cases, information about the dynamic context under which the message occurred is helpful, specifically information about what processing occurred at the network device when the message was generated, as similar messages are often generated from very different processing paths within the device. Knowing the processing or procedure stack when a particular message was generated may therefore be of value; however, by the time diagnostics occurs and a particular syslog message is recognized as being crucial, the state may of the system have changed some time ago. Turning on debug-level messages in many cases provides the necessary information, but it generates too much traffic for real-world operations, and reproducing the exact same error condition (and turning on debug only for that duration) may not be practical and convenient.